Java SecurityConstraint类代码示例

import org.apache.catalina.deploy.SecurityConstraint; //导入依赖的package包/类
private void setUpDigest(Tomcat tomcat) throws Exception {

        // No file system docBase required
        Context ctxt = tomcat.addContext(CONTEXT_PATH_DIGEST, null);
        ctxt.setSessionTimeout(SHORT_TIMEOUT_SECS);

        // Add protected servlet
        Tomcat.addServlet(ctxt, "TesterServlet3", new TesterServlet());
        ctxt.addServletMapping(URI_PROTECTED, "TesterServlet3");
        SecurityCollection collection = new SecurityCollection();
        collection.addPattern(URI_PROTECTED);
        SecurityConstraint sc = new SecurityConstraint();
        sc.addAuthRole(ROLE);
        sc.addCollection(collection);
        ctxt.addConstraint(sc);

        // Configure the appropriate authenticator
        LoginConfig lc = new LoginConfig();
        lc.setAuthMethod("DIGEST");
        ctxt.setLoginConfig(lc);
        ctxt.getPipeline().addValve(new DigestAuthenticator());
    }
 

import org.apache.catalina.deploy.SecurityConstraint; //导入依赖的package包/类
private void doTestNon2xxResponseAndExpectation(boolean useExpectation) throws Exception {
    Tomcat tomcat = getTomcatInstance();

    // No file system docBase required
    Context ctx = tomcat.addContext("", null);

    Tomcat.addServlet(ctx, "echo", new EchoBodyServlet());
    ctx.addServletMapping("/echo", "echo");

    SecurityCollection collection = new SecurityCollection("All", "");
    collection.addPattern("/*");
    SecurityConstraint constraint = new SecurityConstraint();
    constraint.addAuthRole("Any");
    constraint.addCollection(collection);
    ctx.addConstraint(constraint);

    tomcat.start();

    Non2xxResponseClient client = new Non2xxResponseClient(useExpectation);
    client.setPort(getPort());
    client.doResourceRequest("GET http://localhost:" + getPort()
            + "/echo HTTP/1.1", "HelloWorld");
    Assert.assertTrue(client.isResponse403());
    Assert.assertTrue(client.checkConnectionHeader());
}
 

import org.apache.catalina.deploy.SecurityConstraint; //导入依赖的package包/类
/**
* A non-authoritative, pre-emptive determination of whether the currently logged in user
* has privileges to the selected resource.
* 
   * @see gov.va.med.imaging.tomcat.vistarealm.PreemptiveAuthorization#isAuthorized(java.lang.Object, java.lang.String, java.lang.String)
   */
  @Override
  public PreemptiveAuthorization.Result isAuthorized(
  		Principal principal, 
  		Object context, 
  		String contextRequestPath, 
  		String requestMethod)
  {
  	getLogger().info("Preemptively checking authorization '" + principal.getName() + "' to '" + requestMethod + ":" + contextRequestPath + "'.");
  	if(! (context instanceof Context) )
  	{
  		getLogger().warn("Attempt to pre-emptively determine authorization with a context of type other than Tomcat standard Context");
  		return PreemptiveAuthorization.Result.Unknown;
  	}
  	Context tomcatContext = (Context)context;
  	
String requestContextPath = tomcatContext.getName();
String requestPathInfo = requestContextPath + contextRequestPath;

  	getLogger().info("Preemptively checking authorization, getting security constraints.");
SecurityConstraint[] securityConstraints = findSecurityConstraints(tomcatContext, requestPathInfo, requestMethod, contextRequestPath);

  	getLogger().info("Preemptively checking authorization, checking resource permmissions.");
return hasResourcePermission(tomcatContext, securityConstraints, requestPathInfo, principal) ?
		PreemptiveAuthorization.Result.True : PreemptiveAuthorization.Result.False;
  }
 

import org.apache.catalina.deploy.SecurityConstraint; //导入依赖的package包/类
/**
 * Convert an ArrayList to a SecurityContraint [].
 */
private SecurityConstraint[] resultsToArray(ArrayList<SecurityConstraintMatch> results)
{
	if (results == null || results.size() < 1)
		return null;

	SecurityConstraint[] array = new SecurityConstraint[results.size()];

	int index = 0;
	for (SecurityConstraintMatch match : results)
	{
		array[index] = match.getSecurityConstraint();
		++index;
	}

	return array;
}
 

import org.apache.catalina.deploy.SecurityConstraint; //导入依赖的package包/类
private void setUpDigest(Tomcat tomcat) throws Exception {

        // Must have a real docBase for webapps - just use temp
        Context ctxt = tomcat.addContext(CONTEXT_PATH_DIGEST,
                System.getProperty("java.io.tmpdir"));
        ctxt.setSessionTimeout(SHORT_TIMEOUT_SECS);

        // Add protected servlet
        Tomcat.addServlet(ctxt, "TesterServlet3", new TesterServlet());
        ctxt.addServletMapping(URI_PROTECTED, "TesterServlet3");
        SecurityCollection collection = new SecurityCollection();
        collection.addPattern(URI_PROTECTED);
        SecurityConstraint sc = new SecurityConstraint();
        sc.addAuthRole(ROLE);
        sc.addCollection(collection);
        ctxt.addConstraint(sc);

        // Configure the appropriate authenticator
        LoginConfig lc = new LoginConfig();
        lc.setAuthMethod("DIGEST");
        ctxt.setLoginConfig(lc);
        ctxt.getPipeline().addValve(new DigestAuthenticator());
    }
 

import org.apache.catalina.deploy.SecurityConstraint; //导入依赖的package包/类
@Override
public void begin(String namespace, String name, Attributes attributes)
    throws Exception {
    SecurityConstraint securityConstraint =
        (SecurityConstraint) digester.peek();
    securityConstraint.setAuthConstraint(true);
    if (digester.getLogger().isDebugEnabled()) {
        digester.getLogger()
           .debug("Calling SecurityConstraint.setAuthConstraint(true)");
    }
}
 

import org.apache.catalina.deploy.SecurityConstraint; //导入依赖的package包/类
/**
 * Validate the usage of security role names in the web application
 * deployment descriptor.  If any problems are found, issue warning
 * messages (for backwards compatibility) and add the missing roles.
 * (To make these problems fatal instead, simply set the <code>ok</code>
 * instance variable to <code>false</code> as well).
 */
protected void validateSecurityRoles() {

    // Check role names used in <security-constraint> elements
    SecurityConstraint constraints[] = context.findConstraints();
    for (int i = 0; i < constraints.length; i++) {
        String roles[] = constraints[i].findAuthRoles();
        for (int j = 0; j < roles.length; j++) {
            if (!"*".equals(roles[j]) &&
                !context.findSecurityRole(roles[j])) {
                log.warn(sm.getString("contextConfig.role.auth", roles[j]));
                context.addSecurityRole(roles[j]);
            }
        }
    }

    // Check role names used in <servlet> elements
    Container wrappers[] = context.findChildren();
    for (int i = 0; i < wrappers.length; i++) {
        Wrapper wrapper = (Wrapper) wrappers[i];
        String runAs = wrapper.getRunAs();
        if ((runAs != null) && !context.findSecurityRole(runAs)) {
            log.warn(sm.getString("contextConfig.role.runas", runAs));
            context.addSecurityRole(runAs);
        }
        String names[] = wrapper.findSecurityReferences();
        for (int j = 0; j < names.length; j++) {
            String link = wrapper.findSecurityReference(names[j]);
            if ((link != null) && !context.findSecurityRole(link)) {
                log.warn(sm.getString("contextConfig.role.link", link));
                context.addSecurityRole(link);
            }
        }
    }

}
 

import org.apache.catalina.deploy.SecurityConstraint; //导入依赖的package包/类
/**
 * Convert an ArrayList to a SecurityContraint [].
 */
private SecurityConstraint [] resultsToArray(
        ArrayList<SecurityConstraint> results) {
    if(results == null || results.size() == 0) {
        return null;
    }
    SecurityConstraint [] array = new SecurityConstraint[results.size()];
    results.toArray(array);
    return array;
}
 

import org.apache.catalina.deploy.SecurityConstraint; //导入依赖的package包/类
/**
 * Add a security constraint to the set for this web application.
 */
@Override
public void addConstraint(SecurityConstraint constraint) {

    // Validate the proposed constraint
    SecurityCollection collections[] = constraint.findCollections();
    for (int i = 0; i < collections.length; i++) {
        String patterns[] = collections[i].findPatterns();
        for (int j = 0; j < patterns.length; j++) {
            patterns[j] = adjustURLPattern(patterns[j]);
            if (!validateURLPattern(patterns[j]))
                throw new IllegalArgumentException
                    (sm.getString
                     ("standardContext.securityConstraint.pattern",
                      patterns[j]));
        }
        if (collections[i].findMethods().length > 0 &&
                collections[i].findOmittedMethods().length > 0) {
            throw new IllegalArgumentException(sm.getString(
                    "standardContext.securityConstraint.mixHttpMethod"));
        }
    }

    // Add this constraint to the set for our web application
    synchronized (constraintsLock) {
        SecurityConstraint results[] =
            new SecurityConstraint[constraints.length + 1];
        for (int i = 0; i < constraints.length; i++)
            results[i] = constraints[i];
        results[constraints.length] = constraint;
        constraints = results;
    }

}
 

import org.apache.catalina.deploy.SecurityConstraint; //导入依赖的package包/类
/**
 * Remove the specified security constraint from this web application.
 *
 * @param constraint Constraint to be removed
 */
@Override
public void removeConstraint(SecurityConstraint constraint) {

    synchronized (constraintsLock) {

        // Make sure this constraint is currently present
        int n = -1;
        for (int i = 0; i < constraints.length; i++) {
            if (constraints[i].equals(constraint)) {
                n = i;
                break;
            }
        }
        if (n < 0)
            return;

        // Remove the specified constraint
        int j = 0;
        SecurityConstraint results[] =
            new SecurityConstraint[constraints.length - 1];
        for (int i = 0; i < constraints.length; i++) {
            if (i != n)
                results[j++] = constraints[i];
        }
        constraints = results;

    }

    // Inform interested listeners
    fireContainerEvent("removeConstraint", constraint);

}
 

import org.apache.catalina.deploy.SecurityConstraint; //导入依赖的package包/类
private void setUpNonLogin(Tomcat tomcat) throws Exception {

        // No file system docBase required
        Context ctxt = tomcat.addContext(CONTEXT_PATH_NOLOGIN, null);
        ctxt.setSessionTimeout(LONG_TIMEOUT_SECS);

        // Add protected servlet
        Tomcat.addServlet(ctxt, "TesterServlet1", new TesterServlet());
        ctxt.addServletMapping(URI_PROTECTED, "TesterServlet1");
        SecurityCollection collection1 = new SecurityCollection();
        collection1.addPattern(URI_PROTECTED);
        SecurityConstraint sc1 = new SecurityConstraint();
        sc1.addAuthRole(ROLE);
        sc1.addCollection(collection1);
        ctxt.addConstraint(sc1);

        // Add unprotected servlet
        Tomcat.addServlet(ctxt, "TesterServlet2", new TesterServlet());
        ctxt.addServletMapping(URI_PUBLIC, "TesterServlet2");
        SecurityCollection collection2 = new SecurityCollection();
        collection2.addPattern(URI_PUBLIC);
        SecurityConstraint sc2 = new SecurityConstraint();
        // do not add a role - which signals access permitted without one
        sc2.addCollection(collection2);
        ctxt.addConstraint(sc2);

        // Configure the appropriate authenticator
        LoginConfig lc = new LoginConfig();
        lc.setAuthMethod("NONE");
        ctxt.setLoginConfig(lc);
        ctxt.getPipeline().addValve(new NonLoginAuthenticator());
    }
 

import org.apache.catalina.deploy.SecurityConstraint; //导入依赖的package包/类
private void setUpNonLogin() throws Exception {

        // No file system docBase required
        nonloginContext = tomcat.addContext(CONTEXT_PATH_NOLOGIN, null);
        nonloginContext.setSessionTimeout(LONG_SESSION_TIMEOUT_MINS);

        // Add protected servlet to the context
        Tomcat.addServlet(nonloginContext, "TesterServlet1",
                new TesterServletEncodeUrl());
        nonloginContext.addServletMapping(URI_PROTECTED, "TesterServlet1");

        SecurityCollection collection1 = new SecurityCollection();
        collection1.addPattern(URI_PROTECTED);
        SecurityConstraint sc1 = new SecurityConstraint();
        sc1.addAuthRole(ROLE);
        sc1.addCollection(collection1);
        nonloginContext.addConstraint(sc1);

        // Add unprotected servlet to the context
        Tomcat.addServlet(nonloginContext, "TesterServlet2",
                new TesterServletEncodeUrl());
        nonloginContext.addServletMapping(URI_PUBLIC, "TesterServlet2");

        SecurityCollection collection2 = new SecurityCollection();
        collection2.addPattern(URI_PUBLIC);
        SecurityConstraint sc2 = new SecurityConstraint();
        // do not add a role - which signals access permitted without one
        sc2.addCollection(collection2);
        nonloginContext.addConstraint(sc2);

        // Configure the authenticator and inherit the Realm from Engine
        LoginConfig lc = new LoginConfig();
        lc.setAuthMethod("NONE");
        nonloginContext.setLoginConfig(lc);
        AuthenticatorBase nonloginAuthenticator = new NonLoginAuthenticator();
        nonloginContext.getPipeline().addValve(nonloginAuthenticator);
    }
 

import org.apache.catalina.deploy.SecurityConstraint; //导入依赖的package包/类
private void setUpLogin() throws Exception {

        // No file system docBase required
        basicContext = tomcat.addContext(CONTEXT_PATH_LOGIN, null);
        basicContext.setSessionTimeout(SHORT_SESSION_TIMEOUT_MINS);

        // Add protected servlet to the context
        Tomcat.addServlet(basicContext, "TesterServlet3",
                new TesterServletEncodeUrl());
        basicContext.addServletMapping(URI_PROTECTED, "TesterServlet3");
        SecurityCollection collection = new SecurityCollection();
        collection.addPattern(URI_PROTECTED);
        SecurityConstraint sc = new SecurityConstraint();
        sc.addAuthRole(ROLE);
        sc.addCollection(collection);
        basicContext.addConstraint(sc);

        // Add unprotected servlet to the context
        Tomcat.addServlet(basicContext, "TesterServlet4",
                new TesterServletEncodeUrl());
        basicContext.addServletMapping(URI_PUBLIC, "TesterServlet4");
        SecurityCollection collection2 = new SecurityCollection();
        collection2.addPattern(URI_PUBLIC);
        SecurityConstraint sc2 = new SecurityConstraint();
        // do not add a role - which signals access permitted without one
        sc2.addCollection(collection2);
        basicContext.addConstraint(sc2);

        // Configure the authenticator and inherit the Realm from Engine
        LoginConfig lc = new LoginConfig();
        lc.setAuthMethod("BASIC");
        basicContext.setLoginConfig(lc);
        AuthenticatorBase basicAuthenticator = new BasicAuthenticator();
        basicContext.getPipeline().addValve(basicAuthenticator);
    }
 

import org.apache.catalina.deploy.SecurityConstraint; //导入依赖的package包/类
private void setUpNonLogin() throws Exception {

        // No file system docBase required
        nonloginContext = tomcat.addContext(CONTEXT_PATH_NOLOGIN, null);
        nonloginContext.setSessionTimeout(LONG_SESSION_TIMEOUT_MINS);

        // Add protected servlet to the context
        Tomcat.addServlet(nonloginContext, "TesterServlet1", new TesterServlet());
        nonloginContext.addServletMapping(URI_PROTECTED, "TesterServlet1");

        SecurityCollection collection1 = new SecurityCollection();
        collection1.addPattern(URI_PROTECTED);
        SecurityConstraint sc1 = new SecurityConstraint();
        sc1.addAuthRole(ROLE);
        sc1.addCollection(collection1);
        nonloginContext.addConstraint(sc1);

        // Add unprotected servlet to the context
        Tomcat.addServlet(nonloginContext, "TesterServlet2", new TesterServlet());
        nonloginContext.addServletMapping(URI_PUBLIC, "TesterServlet2");

        SecurityCollection collection2 = new SecurityCollection();
        collection2.addPattern(URI_PUBLIC);
        SecurityConstraint sc2 = new SecurityConstraint();
        // do not add a role - which signals access permitted without one
        sc2.addCollection(collection2);
        nonloginContext.addConstraint(sc2);

        // Configure the authenticator and inherit the Realm from Engine
        LoginConfig lc = new LoginConfig();
        lc.setAuthMethod("NONE");
        nonloginContext.setLoginConfig(lc);
        AuthenticatorBase nonloginAuthenticator = new NonLoginAuthenticator();
        nonloginContext.getPipeline().addValve(nonloginAuthenticator);
    }
 

import org.apache.catalina.deploy.SecurityConstraint; //导入依赖的package包/类
private void setUpLogin() throws Exception {

        // No file system docBase required
        basicContext = tomcat.addContext(CONTEXT_PATH_LOGIN, null);
        basicContext.setSessionTimeout(SHORT_SESSION_TIMEOUT_MINS);

        // Add protected servlet to the context
        Tomcat.addServlet(basicContext, "TesterServlet3", new TesterServlet());
        basicContext.addServletMapping(URI_PROTECTED, "TesterServlet3");
        SecurityCollection collection = new SecurityCollection();
        collection.addPattern(URI_PROTECTED);
        SecurityConstraint sc = new SecurityConstraint();
        sc.addAuthRole(ROLE);
        sc.addCollection(collection);
        basicContext.addConstraint(sc);

        // Add unprotected servlet to the context
        Tomcat.addServlet(basicContext, "TesterServlet4", new TesterServlet());
        basicContext.addServletMapping(URI_PUBLIC, "TesterServlet4");

        SecurityCollection collection2 = new SecurityCollection();
        collection2.addPattern(URI_PUBLIC);
        SecurityConstraint sc2 = new SecurityConstraint();
        // do not add a role - which signals access permitted without one
        sc2.addCollection(collection2);
        basicContext.addConstraint(sc2);

        // Configure the authenticator and inherit the Realm from Engine
        LoginConfig lc = new LoginConfig();
        lc.setAuthMethod("BASIC");
        basicContext.setLoginConfig(lc);
        AuthenticatorBase basicAuthenticator = new BasicAuthenticator();
        basicContext.getPipeline().addValve(basicAuthenticator);
    }